I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also tried to create a self-signed certificate using the instructions reported here but the problem is still the same. The only difference is that when the Apple certificate is used (Developer ID Installer: ...) all the chain is dumped to the screen but also for the other certificates only the SHA1 signature is shown.

NOTE: Both certificates reports:

Signature Algorithm: sha256WithRSAEncryption

So it seems like the certificates are SHA256 capable. Is the pkgutil capable of dumping a SHA256 signature ? If the pkgutil is right and the there are no SHA256 signature in the package, how can I force productsign to use both signatures or only the SHA256 one ?